Look, if they were actually obligated by some regulator to ask for KYC then obviously your request would be invalid - if it was that easy for actual money launderers to get away from KYC (by sending a potentially doctored image of their verified Binance account), then it is as good as having no KYC at all.

But my gut tells me that they're not legit, especially since they've promised to customers before that there will be no KYC explicitly in their policy statement.

You're in a sticky situation. I do understand that you are cautious with your docs but it seems like that it'll either be a) you provide them and *potentially* get your funds back, b) you guarantee privacy/security and not provide anything or c) you somehow gain enough publicity to make them panic, but that is unlikely since it's essentially them admitting that they're not a regulated entity.